CVE-2026-116736: libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array
Libpff through 20260926 contains a heap out-of-bounds read vulnerability in libpfftablereadvaluesarray because a 7c column definition's valuesarraysize is not checked against remaining buffer bytes. Attackers can supply a crafted PST, OST or PAB file to make applications read adjacent heap memory into record entry values or crash.
Affected Software
Event History
Frequently Asked Questions
What would an attacker need to exploit this issue?
An attacker would need to provide a crafted PST, OST, or PAB file and have a user or application process that file with an affected libpff version. The supplied CVSS vector indicates local access and user interaction are required, while no privileges are required.
What are the practical consequences of processing a malicious file?
Processing the crafted file can cause the application to read adjacent heap memory into record entry values or crash. The stated impact includes low confidentiality impact and high availability impact.
Which file-processing workflows are exposed?
Workflows that ingest or inspect untrusted PST, OST, or PAB files using libpff are exposed. This can include applications that parse these files after a user opens, imports, or submits them.
What should be done if an update cannot be applied immediately?
Avoid processing untrusted PST, OST, and PAB files with affected libpff-based applications until an update can be applied. Limit such processing to trusted files where possible.